{"id":"CVE-2026-120243","summary":"FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette","details":"FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kempf_restore_buf() copies uninitialized stack bytes, including pointers or stack guards, into decoded output.","modified":"2026-11-04T07:05:50.337038317Z","published":"2026-11-01T00:57:09.338Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-457"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120243.json"},"references":[{"type":"WEB","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120243.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120243"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/ffmpeg-2.0-through-9.0.2-information-disclosure-via-g2m-kempf-palette"},{"type":"REPORT","url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858"},{"type":"FIX","url":"https://github.com/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b"},{"type":"PACKAGE","url":"https://github.com/FFmpeg/FFmpeg"},{"type":"ARTICLE","url":"https://github.com/FFmpeg/FFmpeg/blob/n9.0.2/libavcodec/g2meet.c#L1040-L1042"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ffmpeg/ffmpeg","events":[{"introduced":"2b8b2ba19fe0ca6594cb09439b9ead2c328a79d8"},{"fixed":"edad2d0dafcf44fa315eab716fd0183ce808053b"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.0"},{"last_affected":"9.0.2"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"edad2d0dafcf44fa315eab716fd0183ce808053b"}]}]}}],"versions":["n9.1-dev","n8.2-dev","n8.1-dev","n7.2-dev","n7.1-dev","n6.2-dev","n6.1-dev","n5.2-dev","n5.1-dev","n4.5-dev","n4.4-dev","n4.3-dev","n4.2-dev","n4.1-dev","n3.5-dev","n3.4-dev","n3.3-dev","n3.2-dev","n3.1-dev","n2.9-dev","n2.8-dev","n2.7-dev","n2.6-dev","n2.5-dev","n2.4-dev","n2.3-dev","n2.2-dev","n2.0","n2.1-dev"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-120243.json","vanir_signatures":[{"target":{"file":"libavcodec/g2meet.c","function":"kempf_decode_tile"},"deprecated":false,"digest":{"length":2908,"function_hash":"277565168920903986048159568946715436902"},"id":"CVE-2026-120243-0685d698","signature_type":"Function","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b"},{"signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b","target":{"file":"libavcodec/g2meet.c","function":"kempf_restore_buf"},"deprecated":false,"digest":{"function_hash":"313303952158597708612771819823095048039","length":879},"id":"CVE-2026-120243-d721a5c0","signature_type":"Function"},{"digest":{"threshold":0.9,"line_hashes":["160638809330132786049513158946516797704","248453665855218436820802928550065363906","41090461966814352563360395532882129337","167018126229110959845052330358267497949","278506319865767285754699098173624145677","9751954035493397087702163864157547616","278455037816368709338451336202935266625","328445132475894535928297178309880925901","306038616358422600178464892725079099388","53861815168492439241807527298524982334","311985644659154328471671430624571691936","184710527815914191262460526128836588989","282016809946019814575008900375046406868","17393164924260227996610058207935692244","85628013457806841716702090685921057486","213651570506427380132118718770585892211","123777187023096636640608335531775541014","115598151382465728860241363500275508062","57690502616209468656586865889403695816"]},"id":"CVE-2026-120243-ec70291b","signature_type":"Line","signature_version":"v1","source":"https://github.com/ffmpeg/ffmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b","target":{"file":"libavcodec/g2meet.c"},"deprecated":false}],"vanir_signatures_modified":"2026-11-04T07:05:50Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}